Advisories
Mandriva Advisories
|
 |
| Problem Description |
Cross-site scripting (XSS) vulnerability in search.php in SquirrelMail
1.5.1 and earlier, when register_globals is enabled, allows remote
attackers to inject arbitrary HTML via the mailbox parameter
(CVE-2006-3174).
NOTE: The squirrelmail developers dispute this issue, but the relevant
code has been reworked to be sure. The patch has been applied to the
Mandriva packages.
Dynamic variable evaluation vulnerability in compose.php in
SquirrelMail 1.4.0 to 1.4.7 allows remote attackers to overwrite
arbitrary program variables and read or write the attachments and
references of other users (CVE-2006-4019).
Updated packages are patched to address these issues.
| Updated Packages |
Corporate Server 3.0
06470a6a27239654feffdec4586b464f corporate/3.0/RPMS/squirrelmail-1.4.5-1.4.C30mdk.noarch.rpm 5d3b85ad3d7797f72a234e5608ec5500 corporate/3.0/RPMS/squirrelmail-poutils-1.4.5-1.4.C30mdk.noarch.rpm 0ce03cf1cd50e51f8c1658878abbb1f3 corporate/3.0/SRPMS/squirrelmail-1.4.5-1.4.C30mdk.src.rpm
Corporate Server 3.0/X86_64
f5f5bddbabeebc495cda7fdb4e0a990e x86_64/corporate/3.0/RPMS/squirrelmail-1.4.5-1.4.C30mdk.noarch.rpm 696d2c1669024ddf4ed11b3b2ec1cc42 x86_64/corporate/3.0/RPMS/squirrelmail-poutils-1.4.5-1.4.C30mdk.noarch.rpm 0ce03cf1cd50e51f8c1658878abbb1f3 x86_64/corporate/3.0/SRPMS/squirrelmail-1.4.5-1.4.C30mdk.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4019
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.